> For the complete documentation index, see [llms.txt](https://docs.gotempest.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.gotempest.app/account-and-privacy/where-tempest-stores-credentials.md).

# Where Tempest Stores Your Credentials

When Tempest needs to remember a secret across restarts — your vault unlock key, OAuth tokens, the device push token — it uses the **operating system's secure credential store**. Each platform has its own; Tempest picks the right one automatically. This page explains exactly what gets stored where and how the fallback behaves on systems without a usable keystore.

(For how vault contents themselves are encrypted before sync, see [End-to-End Encryption](/account-and-privacy/end-to-end-encryption.md). This page is about local secret storage.)

## What Tempest stores locally

| Item                                                                        | Why it's stored                                                     |
| --------------------------------------------------------------------------- | ------------------------------------------------------------------- |
| **Vault unlock key** (or a wrapped form of it)                              | So you don't have to type your vault password on every launch       |
| **Sync session token**                                                      | To keep you signed in across app restarts                           |
| **Device push token**                                                       | Long-lived per-device token used by Tempest Push (desktop)          |
| **OAuth2 refresh tokens**                                                   | Renew sync sessions without re-typing credentials                   |
| **Per-host credentials** flagged as *"save in keychain"* (optional, opt-in) | So you can choose to skip vault-level encryption for low-risk hosts |

Everything else (your hosts, snippets, SSH keys, certs) lives inside the encrypted vault — see [End-to-End Encryption](/account-and-privacy/end-to-end-encryption.md).

## Per-platform storage

### macOS — Keychain

Tempest stores secrets in the **macOS Keychain** under the service name `app.gotempest.tempest`. Secrets are protected by your macOS login password and (where available) Touch ID / system biometrics.

To inspect: open **Keychain Access.app** → search for "tempest".

### Windows — Windows Credential Manager

Tempest stores secrets in **Windows Credential Manager** (the same store used by Microsoft Edge, Outlook, and most Win32 apps). Secrets are protected by your Windows account password and DPAPI.

To inspect: **Control Panel → User Accounts → Credential Manager → Windows Credentials** → entries prefixed with `tempest`.

### Linux — Secret Service (libsecret)

Tempest uses the **freedesktop Secret Service API** — implemented by **GNOME Keyring** (default on GNOME, Cinnamon, Unity) or **KWallet** (default on KDE Plasma).

If you're running a desktop environment that ships either, you don't need to do anything. Tempest secrets show up in:

* `seahorse` (GNOME Keyring viewer)
* KWallet Manager

#### **In-memory fallback when no keystore is available**

Some Linux setups have no Secret Service:

* Minimal window managers (i3, sway, dwm, awesome) installed without GNOME Keyring or KWallet
* Headless servers (no DBus session)
* Some restricted enterprise installs

In these cases, Tempest **falls back to an in-memory secret store**. This means:

* **You'll be prompted to enter your vault password every time Tempest starts.**
* Sync session tokens are lost on restart, so you'll re-sign-in to your account too.
* OAuth2 refresh tokens aren't persisted — same caveat.

This is intentional — writing secrets to a plaintext file on disk would be a worse outcome. To enable persistent secret storage, install a Secret Service implementation:

```bash
# Most desktop distros
sudo apt install gnome-keyring   # or libsecret-tools
# Or for KDE
sudo apt install kwalletmanager
```

After install, restart Tempest. It'll detect the new keystore and start using it for the next session's secrets.

### Web Mode (browser)

When Tempest runs in [Web Mode](/deployment/self-hosted-tempest-server.md), there's no OS keystore the browser can write to. Instead:

* Vault unlock key lives in **session storage** — cleared when you close the tab.
* Sync session token lives in a **secure HTTP-only cookie** scoped to your Tempest server.

You'll need to re-enter your vault password each time you open Tempest in a new browser session. This is by design — browsers are too varied an environment to guarantee a secure persistent secret store.

### iOS / Android

Mobile platforms have first-class secure storage:

* **iOS** — **Keychain Services**, hardware-backed by the Secure Enclave when available.
* **Android** — **Android Keystore**, hardware-backed by StrongBox / TEE on supported devices.

Both are Tempest's default; no fallback is needed.

## How to wipe stored credentials

If you want to remove all Tempest secrets from the OS keystore:

| Platform      | Action                                                                |
| ------------- | --------------------------------------------------------------------- |
| macOS         | Keychain Access → search `tempest` → delete entries                   |
| Windows       | Credential Manager → Windows Credentials → delete `tempest:*` entries |
| Linux (GNOME) | `seahorse` → Login keyring → delete `tempest:*` entries               |
| Linux (KDE)   | KWallet Manager → kdewallet → delete `tempest:*` entries              |
| iOS / Android | Uninstall the app — secrets are scoped to the app's keychain entry    |

After wiping, your next Tempest launch starts cold: you'll re-enter your vault password and sign in to sync again.

## Security notes

* Tempest never writes secrets to plaintext files or to its own SQLite database. Secrets are *always* either in the OS keystore or in process memory.
* On macOS / Windows / iOS / Android, the keystore is hardware-protected (Secure Enclave / TPM / StrongBox where available).
* On Linux, security depends on your Secret Service implementation. GNOME Keyring and KWallet both encrypt secrets at rest under your login password.
* The in-memory fallback (Linux without keystore) is *less convenient* but *not less secure* — it just means you re-authenticate on every launch.

## See also

* [End-to-End Encryption](/account-and-privacy/end-to-end-encryption.md) — how the vault contents themselves are encrypted before sync
* [How Tempest Protects Your Privacy](/account-and-privacy/how-tempest-protect-your-privacy.md) — the high-level security overview
* [Reset Your Tempest Password](/account-and-privacy/resetting-password.md) — sync vs. vault password explained